Cloud Rights and Cloud Wrongs?
I received a note from Steve Helms over at Gartner a while back about a release they made covering Rights and Responsibilities for Cloud Computing Services. In it they outline seven rights related to cloud consumption:
1. The right to retain ownership, use and control one's own data
2. The right to service-level agreements that address liabilities, remediation and business outcomes
3. The right to notification and choice about changes that affect the service consumers' business processes
4. The right to understand the technical limitations or requirements of the service up front
5. The right to understand the legal requirements of jurisdictions in which the provider operates
6. The right to know what security processes the provider follows
7. The responsibility to understand and adhere to software license requirements
They provided a paragraph of context to each right as well. I thought this was a thought provoking list.
One area that I believe was only weakly addressed was the right to understand how to move cloud work elsewhere. It may be covered by the 1st or the 2nd right, but it is interesting how poorly understood by many the ramifications of moving work between providers.
Things can happen that shut down some types of service providers and the cost impact can be very high while the ability to move the work elsewhere non-existent. To some extent this is like the old software escrow issue for products, but it is of a much higher priority if it needs to be executed, since it may be production work that resides in the cloud. The reaction to WikiLeaks is a great example of this, where denial of service attacks brought down servers and network domain address, causing collateral damage to those nearby (in the IT sense of the word). What are your rights in that situation? What if there is a termination of service without notice?
With all the integration and connections that the cloud enables, sometimes people (especially SMBs) may not even know they are using a cloud service, and when you find out it may not be pleasant. Know your cloud rights and make sure you know what you’re buying, even if you don’t think it is cloud.